CVE-2026-4424

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Libarchive Redhat

Products

Libarchive Ai Inference Server Cert Manager and 19 more

CVE-2026-42010

Gnutls: gnutls: authentication bypass via nul character in username

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

CVSS 3.1 · 7.1 High EPSS 1.1% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Ai Inference Server Cert Manager and 15 more

CVE-2026-42009

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Ai Inference Server Cert Manager and 25 more

CVE-2026-33846

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Ai Inference Server Cert Manager and 15 more

CVE-2026-33845

Gnutls: gnutls: denial of service via dtls zero-length fragment

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Ai Inference Server Cert Manager and 15 more

CVE-2025-9900

Libtiff: libtiff write-what-where

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Ai Inference Server Discovery Enterprise Linux and 7 more

CVE-2026-26158

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Hummingbird Rhel Els

CVE-2026-26157

Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Hummingbird Rhel Els

CVE-2026-12912

Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux Enterprise Linux Eus and 9 more

CVE-2026-16460

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Bootc Redhat

Products

Bootc Enterprise Linux Hardened Images and 3 more

CVE-2026-16445

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hummingbird Openshift and 5 more

CVE-2026-1584

Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder

A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux Hardened Images and 3 more

CVE-2025-7425

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cert Manager Discovery Enterprise Linux and 14 more

CVE-2025-7424

Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Enterprise Linux Hummingbird Openshift and 3 more

CVE-2026-10118

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ai Inference Server Enterprise Linux Enterprise Linux Eus and 9 more

CVE-2026-107935

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Certifications Edge Manager Enterprise Linux and 5 more

CVE-2025-49796

Libxml: type confusion leads to denial of service (dos)

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

CVSS 3.1 · 9.1 Critical EPSS 1.6% KEV · Not listed

Vendors

Redhat

Products

Cert Manager Discovery Enterprise Linux and 13 more

CVE-2025-49795

Libxml: null pointer dereference leads to denial of service (dos)

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hummingbird Jboss Core Services and 1 more

CVE-2025-49794

Libxml: heap use after free (uaf) leads to denial of service (dos)

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale Cert Manager Enterprise Linux and 13 more

CVE-2026-42012

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Cert Manager Discovery and 14 more